API Reference

Zero Trust

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Casb

CasbApplications

List applications

zero_trust.casb.applications.list(ApplicationListParams**kwargs) -> ApplicationListResponse

GET/accounts/{account_id}/one/applications

Get application details

zero_trust.casb.applications.get(Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]application_id, ApplicationGetParams**kwargs) -> ApplicationGetResponse

GET/accounts/{account_id}/one/applications/{application_id}

ModelsExpand Collapse

List[ApplicationListResponseItem]

id: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]

Vendor identifier (e.g. microsoft_internal, google_workspace).

• BITBUCKET - BITBUCKET
• BOX - BOX
• CONFLUENCE - CONFLUENCE
• DROPBOX - DROPBOX
• GITHUB - GITHUB
• GOOGLE_WORKSPACE - GOOGLE_WORKSPACE
• JIRA - JIRA
• MICROSOFT_INTERNAL - MICROSOFT_INTERNAL
• SALESFORCE - SALESFORCE
• SLACK - SLACK

One of the following:

"BITBUCKET"

"BOX"

"CONFLUENCE"

"DROPBOX"

"GITHUB"

"GOOGLE_WORKSPACE"

"JIRA"

"MICROSOFT_INTERNAL"

"SALESFORCE"

"SLACK"

auth_methods: List[ApplicationListResponseItemAuthMethod]

Available auth methods.

id: str

Auth method identifier.

display_name: str

Human-readable auth method name.

category: str

Vendor category (e.g. Productivity, AI).

description: str

Brief description of the integration.

display_name: str

Human-readable vendor name.

dlp_enabled: bool

Whether DLP scanning is supported.

logo: Optional[str]

Logo path.

permissions: List[ApplicationListResponseItemPermission]

All permissions with severity.

display_name: str

Human-readable permission name.

scope: str

Vendor-native scope identifier.

severity: Literal["low", "medium", "high", "critical"]

Permission sensitivity level.

• low - low
• medium - medium
• high - high
• critical - critical

One of the following:

"low"

"medium"

"high"

"critical"

supported_environments: List[str]

Environments this vendor supports (standard, fedramp).

use_cases: List[ApplicationListResponseItemUseCase]

Supported use cases.

id: str

Use case identifier (e.g. casb, ces).

display_name: str

Human-readable use case name.

class ApplicationGetResponse: …

Full application detail for onboarding UI.

id: Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]

Vendor identifier.

• BITBUCKET - BITBUCKET
• BOX - BOX
• CONFLUENCE - CONFLUENCE
• DROPBOX - DROPBOX
• GITHUB - GITHUB
• GOOGLE_WORKSPACE - GOOGLE_WORKSPACE
• JIRA - JIRA
• MICROSOFT_INTERNAL - MICROSOFT_INTERNAL
• SALESFORCE - SALESFORCE
• SLACK - SLACK

One of the following:

"BITBUCKET"

"BOX"

"CONFLUENCE"

"DROPBOX"

"GITHUB"

"GOOGLE_WORKSPACE"

"JIRA"

"MICROSOFT_INTERNAL"

"SALESFORCE"

"SLACK"

auth_methods: List[AuthMethod]

Available authentication methods.

id: str

Auth method identifier.

display_name: str

Human-readable auth method name.

is_default: bool

Whether this is the default auth method.

supported_environments: List[str]

Environments this auth method supports.

category: str

Vendor category.

description: str

Brief description.

display_name: str

Human-readable vendor name.

dlp_enabled: bool

Whether DLP scanning is supported.

instructions: Optional[str]

Setup instructions for the user.

logo: Optional[str]

Logo path.

use_cases: List[UseCase]

Use cases with full scope details.

id: str

Use case identifier.

base_scopes: List[UseCaseBaseScope]

Scopes always required for this use case.

display_name: str

Human-readable permission name.

scope: str

Vendor-native scope identifier.

severity: Literal["low", "medium", "high", "critical"]

Permission sensitivity level.

• low - low
• medium - medium
• high - high
• critical - critical

One of the following:

"low"

"medium"

"high"

"critical"

description: str

Use case description.

display_name: str

Human-readable use case name.

features: List[UseCaseFeature]

Optional features with extra scopes.

id: str

Feature identifier.

description: str

Feature description.

display_name: str

Human-readable feature name.

scopes: List[UseCaseFeatureScope]

Additional scopes when feature is enabled.

display_name: str

Human-readable permission name.

scope: str

Vendor-native scope identifier.

severity: Literal["low", "medium", "high", "critical"]

Permission sensitivity level.

• low - low
• medium - medium
• high - high
• critical - critical

One of the following:

"low"

"medium"

"high"

"critical"

CasbApplicationsAuth Methods

Get auth methods

zero_trust.casb.applications.auth_methods.list(Literal["BITBUCKET", "BOX", "CONFLUENCE", 7 more]application_id, AuthMethodListParams**kwargs) -> AuthMethodListResponse

GET/accounts/{account_id}/one/applications/{application_id}/auth-methods

ModelsExpand Collapse

List[AuthMethodListResponseItem]

id: str

Auth method identifier.

display_name: str

Human-readable auth method name.

human_interaction_required: bool

Whether setup requires human interaction or integration can be created purely using API (e.g., For OAuth can not be created without user interaction).

instructions: AuthMethodListResponseItemInstructions

Step-by-step instructions for obtaining credentials.

markdown: str

Detailed instructions in markdown format.

payload_example: Optional[Dict[str, object]]

Example credentials payload with placeholder values.

payload_schema: Optional[Dict[str, object]]

JSON Schema for the credentials object in POST /v2/integrations request.

redirect_url: Optional[str]

OAuth redirect URL for vendors requiring human interaction.

CasbIntegrations

List integrations

zero_trust.casb.integrations.list(IntegrationListParams**kwargs) -> object

GET/accounts/{account_id}/one/integrations

Get integration details

zero_trust.casb.integrations.get(strid, IntegrationGetParams**kwargs) -> IntegrationGetResponse

GET/accounts/{account_id}/one/integrations/{id}

Create integration

zero_trust.casb.integrations.create(IntegrationCreateParams**kwargs) -> IntegrationCreateResponse

POST/accounts/{account_id}/one/integrations

Update integration

zero_trust.casb.integrations.update(strid, IntegrationUpdateParams**kwargs) -> IntegrationUpdateResponse

PATCH/accounts/{account_id}/one/integrations/{id}

Delete integration

zero_trust.casb.integrations.delete(strid, IntegrationDeleteParams**kwargs)

DELETE/accounts/{account_id}/one/integrations/{id}

Pause integration

zero_trust.casb.integrations.pause(strid, IntegrationPauseParams**kwargs) -> IntegrationPauseResponse

POST/accounts/{account_id}/one/integrations/{id}/pause

Resume integration

zero_trust.casb.integrations.resume(strid, IntegrationResumeParams**kwargs) -> IntegrationResumeResponse

POST/accounts/{account_id}/one/integrations/{id}/resume

ModelsExpand Collapse

class IntegrationGetResponse: …

Serializer for v2 integration detail response with use cases.

id: str

Integration ID.

formatuuid

application: Dict[str, Optional[str]]

auth_method: Optional[Dict[str, str]]

The integration’s authentication method.

authorization_link: Optional[AuthorizationLink]

Authorization link for the integration.

components: Optional[Dict[str, object]]

link: Optional[str]

created: datetime

When the integration was created.

formatdate-time

credentials_expiry: datetime

Credentials expiry time.

formatdate-time

dlp_profiles: List[str]

DLP Profiles enabled for the integration.

health_details: List[Dict[str, object]]

Health details with remediation hints.

is_paused: bool

Whether the user paused the integration.

last_hydrated: datetime

Last time the integration was hydrated.

formatdate-time

name: str

Name of the integration.

organization_id: int

Organization ID.

status: str

Integration status.

updated: datetime

When the integration was last updated.

formatdate-time

use_cases: List[Dict[str, object]]

Use cases enabled for the integration.

class IntegrationCreateResponse: …

Serializer for v2 integration detail response with use cases.

id: str

Integration ID.

formatuuid

application: Dict[str, Optional[str]]

auth_method: Optional[Dict[str, str]]

The integration’s authentication method.

authorization_link: Optional[AuthorizationLink]

Authorization link for the integration.

components: Optional[Dict[str, object]]

link: Optional[str]

created: datetime

When the integration was created.

formatdate-time

credentials_expiry: datetime

Credentials expiry time.

formatdate-time

dlp_profiles: List[str]

DLP Profiles enabled for the integration.

health_details: List[Dict[str, object]]

Health details with remediation hints.

is_paused: bool

Whether the user paused the integration.

last_hydrated: datetime

Last time the integration was hydrated.

formatdate-time

name: str

Name of the integration.

organization_id: int

Organization ID.

status: str

Integration status.

updated: datetime

When the integration was last updated.

formatdate-time

use_cases: List[Dict[str, object]]

Use cases enabled for the integration.

class IntegrationUpdateResponse: …

Serializer for v2 integration detail response with use cases.

id: str

Integration ID.

formatuuid

application: Dict[str, Optional[str]]

auth_method: Optional[Dict[str, str]]

The integration’s authentication method.

authorization_link: Optional[AuthorizationLink]

Authorization link for the integration.

components: Optional[Dict[str, object]]

link: Optional[str]

created: datetime

When the integration was created.

formatdate-time

credentials_expiry: datetime

Credentials expiry time.

formatdate-time

dlp_profiles: List[str]

DLP Profiles enabled for the integration.

health_details: List[Dict[str, object]]

Health details with remediation hints.

is_paused: bool

Whether the user paused the integration.

last_hydrated: datetime

Last time the integration was hydrated.

formatdate-time

name: str

Name of the integration.

organization_id: int

Organization ID.

status: str

Integration status.

updated: datetime

When the integration was last updated.

formatdate-time

use_cases: List[Dict[str, object]]

Use cases enabled for the integration.

class IntegrationPauseResponse: …

Serializer for v2 integration detail response with use cases.

id: str

Integration ID.

formatuuid

application: Dict[str, Optional[str]]

auth_method: Optional[Dict[str, str]]

The integration’s authentication method.

authorization_link: Optional[AuthorizationLink]

Authorization link for the integration.

components: Optional[Dict[str, object]]

link: Optional[str]

created: datetime

When the integration was created.

formatdate-time

credentials_expiry: datetime

Credentials expiry time.

formatdate-time

dlp_profiles: List[str]

DLP Profiles enabled for the integration.

health_details: List[Dict[str, object]]

Health details with remediation hints.

is_paused: bool

Whether the user paused the integration.

last_hydrated: datetime

Last time the integration was hydrated.

formatdate-time

name: str

Name of the integration.

organization_id: int

Organization ID.

status: str

Integration status.

updated: datetime

When the integration was last updated.

formatdate-time

use_cases: List[Dict[str, object]]

Use cases enabled for the integration.

class IntegrationResumeResponse: …

Serializer for v2 integration detail response with use cases.

id: str

Integration ID.

formatuuid

application: Dict[str, Optional[str]]

auth_method: Optional[Dict[str, str]]

The integration’s authentication method.

authorization_link: Optional[AuthorizationLink]

Authorization link for the integration.

components: Optional[Dict[str, object]]

link: Optional[str]

created: datetime

When the integration was created.

formatdate-time

credentials_expiry: datetime

Credentials expiry time.

formatdate-time

dlp_profiles: List[str]

DLP Profiles enabled for the integration.

health_details: List[Dict[str, object]]

Health details with remediation hints.

is_paused: bool

Whether the user paused the integration.

last_hydrated: datetime

Last time the integration was hydrated.

formatdate-time

name: str

Name of the integration.

organization_id: int

Organization ID.

status: str

Integration status.

updated: datetime

When the integration was last updated.

formatdate-time

use_cases: List[Dict[str, object]]

Use cases enabled for the integration.

CasbPosture

CasbPostureFindings

List posture findings

zero_trust.casb.posture.findings.list(FindingListParams**kwargs) -> SyncV4PagePaginationArray[FindingListResponse]

GET/accounts/{account_id}/data-security/posture/findings

Get a finding type

zero_trust.casb.posture.findings.get(strfinding_id, FindingGetParams**kwargs) -> FindingGetResponse

GET/accounts/{account_id}/data-security/posture/findings/{finding_id}

Create new findings export request

zero_trust.casb.posture.findings.export(FindingExportParams**kwargs) -> FindingExportResponse

POST/accounts/{account_id}/data-security/posture/findings/export

Mark a finding as ignored

zero_trust.casb.posture.findings.ignore(FindingIgnoreParams**kwargs) -> FindingIgnoreResponse

POST/accounts/{account_id}/data-security/posture/findings/ignore

Remove ignore marker from a finding

zero_trust.casb.posture.findings.unignore(FindingUnignoreParams**kwargs) -> FindingUnignoreResponse

POST/accounts/{account_id}/data-security/posture/findings/unignore

Update the severity for a finding

zero_trust.casb.posture.findings.tune_severity(strfinding_id, FindingTuneSeverityParams**kwargs) -> FindingTuneSeverityResponse

POST/accounts/{account_id}/data-security/posture/findings/{finding_id}/tune_finding_severity

Reset severity for a finding back to the default

zero_trust.casb.posture.findings.reset_severity(strfinding_id, FindingResetSeverityParams**kwargs) -> FindingResetSeverityResponse

POST/accounts/{account_id}/data-security/posture/findings/{finding_id}/reset_finding_severity

ModelsExpand Collapse

class FindingListResponse: …

Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: str

Base64 encoded identifier of the security finding.

formatbyte

active_count: int

Number of active problematic instances identified in the security finding.

archived_count: int

Number of archived instances identified in the security finding.

finding: Finding

Basic finding type information.

id: str

The unique identifier of the finding.

formatuuid

category: FindingCategory

Category information for a finding.

observation: Literal["Issue", "Insight", "Activity"]

The type of the observation.

One of the following:

"Issue"

"Insight"

"Activity"

product: Literal["SaaS", "Cloud"]

The product category.

One of the following:

"SaaS"

"Cloud"

type: Literal["Content", "Posture"]

The type of the finding category.

One of the following:

"Content"

"Posture"

name: str

The name of the finding.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

vendor: str

The SaaS/Cloud vendor of the platform with which the finding is associated.

description: Optional[str]

Detailed description of the finding.

remediation: Optional[FindingRemediation]

Remediation guide information for a finding.

id: str

Remediation Id.

formatuuid

frameworks: List[str]

Relevant Compliance Frameworks.

guide: str

Remediation guide text.

impact: str

Description of the potential impact.

locale: str

I18N Locale.

threat: str

Description of the threat.

ignored: bool

Determines if finding is currently ignored.

instance_count: int

Number of total (Active or archived) problematic instances identified in the security finding.

integration: Integration

Summary information about an integration.

created: datetime

When entity was created.

formatdate-time

last_hydrated: datetime

When were the integration credentials last updated.

formatdate-time

name: str

Name of the integration.

maxLength256

permissions: List[str]

The vendor-specific permissions associated with the integration.

policy: IntegrationPolicy

Policy configuration for an integration.

id: Optional[str]

Policy identifier.

formatuuid

client_id: Optional[str]

OAuth client ID for the policy.

compliance_level: Optional[str]

Compliance level for the policy.

dlp_enabled: Optional[bool]

Whether DLP is enabled for this policy.

link: Optional[str]

Link to policy documentation.

formaturi

name: Optional[str]

Policy name.

permissions: Optional[List[str]]

List of permissions included in the policy.

status: str

Current status of the integration.

updated: datetime

Last entity was updated.

formatdate-time

upgradable: bool

Whether the integrations permissions can be updated.

vendor: IntegrationVendor

Information about a vendor/service provider.

id: str

The id of the vendor.

description: Optional[str]

Detailed information about what kinds of issues are detected for this vendor.

display_name: str

The display name of the vendor.

logo: str

Logo URL for the vendor.

formaturi

name: str

The name of the vendor.

static_logo: str

Static logo URL for the vendor.

formaturi

zt_enrollments: List[str]

The vendor’s compatible Zero Trust products.

policies: Optional[List[Dict[str, object]]]

The policies related to the vendor.

zt_enrollments: List[IntegrationZtEnrollment]

Zero Trust products associated with this integration.

id: Optional[str]

The internal identifier of the Zero Trust Product.

description: Optional[str]

Brief description of the Zero Trust Product.

display_name: Optional[str]

The verbose name of the Zero Trust Product.

enabled: Optional[bool]

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

id: Optional[str]

Integration ID.

formatuuid

credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]

Health status of integration credentials.

One of the following:

"Initializing"

"Healthy"

"Unhealthy"

credentials_expiry: Optional[datetime]

The date and time when the integration credentials will expire.

formatdate-time

is_paused: Optional[bool]

Whether the given integration is paused by the user.

upgrade_dismissed: Optional[bool]

UI State as to whether a potential permissions upgrade has been dismissed.

latest_affliction_date: datetime

Timestamp of the latest affliction date of an active finding.

formatdate-time

severity_override: Optional[SeverityOverride]

Override information for finding severity.

created_by: str

User ID who created the override.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

class FindingGetResponse: …

Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: str

Base64 encoded identifier of the security finding.

formatbyte

active_count: int

Number of active problematic instances identified in the security finding.

archived_count: int

Number of archived instances identified in the security finding.

finding: Finding

Basic finding type information.

id: str

The unique identifier of the finding.

formatuuid

category: FindingCategory

Category information for a finding.

observation: Literal["Issue", "Insight", "Activity"]

The type of the observation.

One of the following:

"Issue"

"Insight"

"Activity"

product: Literal["SaaS", "Cloud"]

The product category.

One of the following:

"SaaS"

"Cloud"

type: Literal["Content", "Posture"]

The type of the finding category.

One of the following:

"Content"

"Posture"

name: str

The name of the finding.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

vendor: str

The SaaS/Cloud vendor of the platform with which the finding is associated.

description: Optional[str]

Detailed description of the finding.

remediation: Optional[FindingRemediation]

Remediation guide information for a finding.

id: str

Remediation Id.

formatuuid

frameworks: List[str]

Relevant Compliance Frameworks.

guide: str

Remediation guide text.

impact: str

Description of the potential impact.

locale: str

I18N Locale.

threat: str

Description of the threat.

ignored: bool

Determines if finding is currently ignored.

instance_count: int

Number of total (Active or archived) problematic instances identified in the security finding.

integration: Integration

Summary information about an integration.

created: datetime

When entity was created.

formatdate-time

last_hydrated: datetime

When were the integration credentials last updated.

formatdate-time

name: str

Name of the integration.

maxLength256

permissions: List[str]

The vendor-specific permissions associated with the integration.

policy: IntegrationPolicy

Policy configuration for an integration.

id: Optional[str]

Policy identifier.

formatuuid

client_id: Optional[str]

OAuth client ID for the policy.

compliance_level: Optional[str]

Compliance level for the policy.

dlp_enabled: Optional[bool]

Whether DLP is enabled for this policy.

link: Optional[str]

Link to policy documentation.

formaturi

name: Optional[str]

Policy name.

permissions: Optional[List[str]]

List of permissions included in the policy.

status: str

Current status of the integration.

updated: datetime

Last entity was updated.

formatdate-time

upgradable: bool

Whether the integrations permissions can be updated.

vendor: IntegrationVendor

Information about a vendor/service provider.

id: str

The id of the vendor.

description: Optional[str]

Detailed information about what kinds of issues are detected for this vendor.

display_name: str

The display name of the vendor.

logo: str

Logo URL for the vendor.

formaturi

name: str

The name of the vendor.

static_logo: str

Static logo URL for the vendor.

formaturi

zt_enrollments: List[str]

The vendor’s compatible Zero Trust products.

policies: Optional[List[Dict[str, object]]]

The policies related to the vendor.

zt_enrollments: List[IntegrationZtEnrollment]

Zero Trust products associated with this integration.

id: Optional[str]

The internal identifier of the Zero Trust Product.

description: Optional[str]

Brief description of the Zero Trust Product.

display_name: Optional[str]

The verbose name of the Zero Trust Product.

enabled: Optional[bool]

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

id: Optional[str]

Integration ID.

formatuuid

credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]

Health status of integration credentials.

One of the following:

"Initializing"

"Healthy"

"Unhealthy"

credentials_expiry: Optional[datetime]

The date and time when the integration credentials will expire.

formatdate-time

is_paused: Optional[bool]

Whether the given integration is paused by the user.

upgrade_dismissed: Optional[bool]

UI State as to whether a potential permissions upgrade has been dismissed.

latest_affliction_date: datetime

Timestamp of the latest affliction date of an active finding.

formatdate-time

severity_override: Optional[SeverityOverride]

Override information for finding severity.

created_by: str

User ID who created the override.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

class FindingExportResponse: …

Information about an export job.

id: str

Unique identifier for the export job.

formatuuid

status: Literal["Pending", "Success", "Failure", 2 more]

Status of an export job.

One of the following:

"Pending"

"Success"

"Failure"

"Rescheduled"

"In-Progress"

type: Literal["finding", "findingInstance", "content", "remediationJob"]

Type of export job.

One of the following:

"finding"

"findingInstance"

"content"

"remediationJob"

user_id: str

ID of the export-requesting user.

maxLength128

download_url: Optional[str]

The URL by which the successfully created export can be downloaded by the end users.

formaturi

maxLength1024

errors: Optional[str]

Contains information on errors which may have occurred during export creation.

file_name: Optional[str]

The base name of the file that is/was generated by the export job.

maxLength256

file_path: Optional[str]

The full path of the file that is stored within external storage (currently R2).

maxLength512

class FindingIgnoreResponse: …

Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: str

Base64 encoded identifier of the security finding.

formatbyte

active_count: int

Number of active problematic instances identified in the security finding.

archived_count: int

Number of archived instances identified in the security finding.

finding: Finding

Basic finding type information.

id: str

The unique identifier of the finding.

formatuuid

category: FindingCategory

Category information for a finding.

observation: Literal["Issue", "Insight", "Activity"]

The type of the observation.

One of the following:

"Issue"

"Insight"

"Activity"

product: Literal["SaaS", "Cloud"]

The product category.

One of the following:

"SaaS"

"Cloud"

type: Literal["Content", "Posture"]

The type of the finding category.

One of the following:

"Content"

"Posture"

name: str

The name of the finding.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

vendor: str

The SaaS/Cloud vendor of the platform with which the finding is associated.

description: Optional[str]

Detailed description of the finding.

remediation: Optional[FindingRemediation]

Remediation guide information for a finding.

id: str

Remediation Id.

formatuuid

frameworks: List[str]

Relevant Compliance Frameworks.

guide: str

Remediation guide text.

impact: str

Description of the potential impact.

locale: str

I18N Locale.

threat: str

Description of the threat.

ignored: bool

Determines if finding is currently ignored.

instance_count: int

Number of total (Active or archived) problematic instances identified in the security finding.

integration: Integration

Summary information about an integration.

created: datetime

When entity was created.

formatdate-time

last_hydrated: datetime

When were the integration credentials last updated.

formatdate-time

name: str

Name of the integration.

maxLength256

permissions: List[str]

The vendor-specific permissions associated with the integration.

policy: IntegrationPolicy

Policy configuration for an integration.

id: Optional[str]

Policy identifier.

formatuuid

client_id: Optional[str]

OAuth client ID for the policy.

compliance_level: Optional[str]

Compliance level for the policy.

dlp_enabled: Optional[bool]

Whether DLP is enabled for this policy.

link: Optional[str]

Link to policy documentation.

formaturi

name: Optional[str]

Policy name.

permissions: Optional[List[str]]

List of permissions included in the policy.

status: str

Current status of the integration.

updated: datetime

Last entity was updated.

formatdate-time

upgradable: bool

Whether the integrations permissions can be updated.

vendor: IntegrationVendor

Information about a vendor/service provider.

id: str

The id of the vendor.

description: Optional[str]

Detailed information about what kinds of issues are detected for this vendor.

display_name: str

The display name of the vendor.

logo: str

Logo URL for the vendor.

formaturi

name: str

The name of the vendor.

static_logo: str

Static logo URL for the vendor.

formaturi

zt_enrollments: List[str]

The vendor’s compatible Zero Trust products.

policies: Optional[List[Dict[str, object]]]

The policies related to the vendor.

zt_enrollments: List[IntegrationZtEnrollment]

Zero Trust products associated with this integration.

id: Optional[str]

The internal identifier of the Zero Trust Product.

description: Optional[str]

Brief description of the Zero Trust Product.

display_name: Optional[str]

The verbose name of the Zero Trust Product.

enabled: Optional[bool]

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

id: Optional[str]

Integration ID.

formatuuid

credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]

Health status of integration credentials.

One of the following:

"Initializing"

"Healthy"

"Unhealthy"

credentials_expiry: Optional[datetime]

The date and time when the integration credentials will expire.

formatdate-time

is_paused: Optional[bool]

Whether the given integration is paused by the user.

upgrade_dismissed: Optional[bool]

UI State as to whether a potential permissions upgrade has been dismissed.

latest_affliction_date: datetime

Timestamp of the latest affliction date of an active finding.

formatdate-time

severity_override: Optional[SeverityOverride]

Override information for finding severity.

created_by: str

User ID who created the override.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

class FindingUnignoreResponse: …

Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: str

Base64 encoded identifier of the security finding.

formatbyte

active_count: int

Number of active problematic instances identified in the security finding.

archived_count: int

Number of archived instances identified in the security finding.

finding: Finding

Basic finding type information.

id: str

The unique identifier of the finding.

formatuuid

category: FindingCategory

Category information for a finding.

observation: Literal["Issue", "Insight", "Activity"]

The type of the observation.

One of the following:

"Issue"

"Insight"

"Activity"

product: Literal["SaaS", "Cloud"]

The product category.

One of the following:

"SaaS"

"Cloud"

type: Literal["Content", "Posture"]

The type of the finding category.

One of the following:

"Content"

"Posture"

name: str

The name of the finding.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

vendor: str

The SaaS/Cloud vendor of the platform with which the finding is associated.

description: Optional[str]

Detailed description of the finding.

remediation: Optional[FindingRemediation]

Remediation guide information for a finding.

id: str

Remediation Id.

formatuuid

frameworks: List[str]

Relevant Compliance Frameworks.

guide: str

Remediation guide text.

impact: str

Description of the potential impact.

locale: str

I18N Locale.

threat: str

Description of the threat.

ignored: bool

Determines if finding is currently ignored.

instance_count: int

Number of total (Active or archived) problematic instances identified in the security finding.

integration: Integration

Summary information about an integration.

created: datetime

When entity was created.

formatdate-time

last_hydrated: datetime

When were the integration credentials last updated.

formatdate-time

name: str

Name of the integration.

maxLength256

permissions: List[str]

The vendor-specific permissions associated with the integration.

policy: IntegrationPolicy

Policy configuration for an integration.

id: Optional[str]

Policy identifier.

formatuuid

client_id: Optional[str]

OAuth client ID for the policy.

compliance_level: Optional[str]

Compliance level for the policy.

dlp_enabled: Optional[bool]

Whether DLP is enabled for this policy.

link: Optional[str]

Link to policy documentation.

formaturi

name: Optional[str]

Policy name.

permissions: Optional[List[str]]

List of permissions included in the policy.

status: str

Current status of the integration.

updated: datetime

Last entity was updated.

formatdate-time

upgradable: bool

Whether the integrations permissions can be updated.

vendor: IntegrationVendor

Information about a vendor/service provider.

id: str

The id of the vendor.

description: Optional[str]

Detailed information about what kinds of issues are detected for this vendor.

display_name: str

The display name of the vendor.

logo: str

Logo URL for the vendor.

formaturi

name: str

The name of the vendor.

static_logo: str

Static logo URL for the vendor.

formaturi

zt_enrollments: List[str]

The vendor’s compatible Zero Trust products.

policies: Optional[List[Dict[str, object]]]

The policies related to the vendor.

zt_enrollments: List[IntegrationZtEnrollment]

Zero Trust products associated with this integration.

id: Optional[str]

The internal identifier of the Zero Trust Product.

description: Optional[str]

Brief description of the Zero Trust Product.

display_name: Optional[str]

The verbose name of the Zero Trust Product.

enabled: Optional[bool]

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

id: Optional[str]

Integration ID.

formatuuid

credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]

Health status of integration credentials.

One of the following:

"Initializing"

"Healthy"

"Unhealthy"

credentials_expiry: Optional[datetime]

The date and time when the integration credentials will expire.

formatdate-time

is_paused: Optional[bool]

Whether the given integration is paused by the user.

upgrade_dismissed: Optional[bool]

UI State as to whether a potential permissions upgrade has been dismissed.

latest_affliction_date: datetime

Timestamp of the latest affliction date of an active finding.

formatdate-time

severity_override: Optional[SeverityOverride]

Override information for finding severity.

created_by: str

User ID who created the override.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

class FindingTuneSeverityResponse: …

Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: str

Base64 encoded identifier of the security finding.

formatbyte

active_count: int

Number of active problematic instances identified in the security finding.

archived_count: int

Number of archived instances identified in the security finding.

finding: Finding

Basic finding type information.

id: str

The unique identifier of the finding.

formatuuid

category: FindingCategory

Category information for a finding.

observation: Literal["Issue", "Insight", "Activity"]

The type of the observation.

One of the following:

"Issue"

"Insight"

"Activity"

product: Literal["SaaS", "Cloud"]

The product category.

One of the following:

"SaaS"

"Cloud"

type: Literal["Content", "Posture"]

The type of the finding category.

One of the following:

"Content"

"Posture"

name: str

The name of the finding.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

vendor: str

The SaaS/Cloud vendor of the platform with which the finding is associated.

description: Optional[str]

Detailed description of the finding.

remediation: Optional[FindingRemediation]

Remediation guide information for a finding.

id: str

Remediation Id.

formatuuid

frameworks: List[str]

Relevant Compliance Frameworks.

guide: str

Remediation guide text.

impact: str

Description of the potential impact.

locale: str

I18N Locale.

threat: str

Description of the threat.

ignored: bool

Determines if finding is currently ignored.

instance_count: int

Number of total (Active or archived) problematic instances identified in the security finding.

integration: Integration

Summary information about an integration.

created: datetime

When entity was created.

formatdate-time

last_hydrated: datetime

When were the integration credentials last updated.

formatdate-time

name: str

Name of the integration.

maxLength256

permissions: List[str]

The vendor-specific permissions associated with the integration.

policy: IntegrationPolicy

Policy configuration for an integration.

id: Optional[str]

Policy identifier.

formatuuid

client_id: Optional[str]

OAuth client ID for the policy.

compliance_level: Optional[str]

Compliance level for the policy.

dlp_enabled: Optional[bool]

Whether DLP is enabled for this policy.

link: Optional[str]

Link to policy documentation.

formaturi

name: Optional[str]

Policy name.

permissions: Optional[List[str]]

List of permissions included in the policy.

status: str

Current status of the integration.

updated: datetime

Last entity was updated.

formatdate-time

upgradable: bool

Whether the integrations permissions can be updated.

vendor: IntegrationVendor

Information about a vendor/service provider.

id: str

The id of the vendor.

description: Optional[str]

Detailed information about what kinds of issues are detected for this vendor.

display_name: str

The display name of the vendor.

logo: str

Logo URL for the vendor.

formaturi

name: str

The name of the vendor.

static_logo: str

Static logo URL for the vendor.

formaturi

zt_enrollments: List[str]

The vendor’s compatible Zero Trust products.

policies: Optional[List[Dict[str, object]]]

The policies related to the vendor.

zt_enrollments: List[IntegrationZtEnrollment]

Zero Trust products associated with this integration.

id: Optional[str]

The internal identifier of the Zero Trust Product.

description: Optional[str]

Brief description of the Zero Trust Product.

display_name: Optional[str]

The verbose name of the Zero Trust Product.

enabled: Optional[bool]

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

id: Optional[str]

Integration ID.

formatuuid

credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]

Health status of integration credentials.

One of the following:

"Initializing"

"Healthy"

"Unhealthy"

credentials_expiry: Optional[datetime]

The date and time when the integration credentials will expire.

formatdate-time

is_paused: Optional[bool]

Whether the given integration is paused by the user.

upgrade_dismissed: Optional[bool]

UI State as to whether a potential permissions upgrade has been dismissed.

latest_affliction_date: datetime

Timestamp of the latest affliction date of an active finding.

formatdate-time

severity_override: Optional[SeverityOverride]

Override information for finding severity.

created_by: str

User ID who created the override.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

class FindingResetSeverityResponse: …

Aggregated finding information with counts and metadata. This is optimized for list API queries and represents a finding along with its instance statistics.

id: str

Base64 encoded identifier of the security finding.

formatbyte

active_count: int

Number of active problematic instances identified in the security finding.

archived_count: int

Number of archived instances identified in the security finding.

finding: Finding

Basic finding type information.

id: str

The unique identifier of the finding.

formatuuid

category: FindingCategory

Category information for a finding.

observation: Literal["Issue", "Insight", "Activity"]

The type of the observation.

One of the following:

"Issue"

"Insight"

"Activity"

product: Literal["SaaS", "Cloud"]

The product category.

One of the following:

"SaaS"

"Cloud"

type: Literal["Content", "Posture"]

The type of the finding category.

One of the following:

"Content"

"Posture"

name: str

The name of the finding.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

vendor: str

The SaaS/Cloud vendor of the platform with which the finding is associated.

description: Optional[str]

Detailed description of the finding.

remediation: Optional[FindingRemediation]

Remediation guide information for a finding.

id: str

Remediation Id.

formatuuid

frameworks: List[str]

Relevant Compliance Frameworks.

guide: str

Remediation guide text.

impact: str

Description of the potential impact.

locale: str

I18N Locale.

threat: str

Description of the threat.

ignored: bool

Determines if finding is currently ignored.

instance_count: int

Number of total (Active or archived) problematic instances identified in the security finding.

integration: Integration

Summary information about an integration.

created: datetime

When entity was created.

formatdate-time

last_hydrated: datetime

When were the integration credentials last updated.

formatdate-time

name: str

Name of the integration.

maxLength256

permissions: List[str]

The vendor-specific permissions associated with the integration.

policy: IntegrationPolicy

Policy configuration for an integration.

id: Optional[str]

Policy identifier.

formatuuid

client_id: Optional[str]

OAuth client ID for the policy.

compliance_level: Optional[str]

Compliance level for the policy.

dlp_enabled: Optional[bool]

Whether DLP is enabled for this policy.

link: Optional[str]

Link to policy documentation.

formaturi

name: Optional[str]

Policy name.

permissions: Optional[List[str]]

List of permissions included in the policy.

status: str

Current status of the integration.

updated: datetime

Last entity was updated.

formatdate-time

upgradable: bool

Whether the integrations permissions can be updated.

vendor: IntegrationVendor

Information about a vendor/service provider.

id: str

The id of the vendor.

description: Optional[str]

Detailed information about what kinds of issues are detected for this vendor.

display_name: str

The display name of the vendor.

logo: str

Logo URL for the vendor.

formaturi

name: str

The name of the vendor.

static_logo: str

Static logo URL for the vendor.

formaturi

zt_enrollments: List[str]

The vendor’s compatible Zero Trust products.

policies: Optional[List[Dict[str, object]]]

The policies related to the vendor.

zt_enrollments: List[IntegrationZtEnrollment]

Zero Trust products associated with this integration.

id: Optional[str]

The internal identifier of the Zero Trust Product.

description: Optional[str]

Brief description of the Zero Trust Product.

display_name: Optional[str]

The verbose name of the Zero Trust Product.

enabled: Optional[bool]

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

id: Optional[str]

Integration ID.

formatuuid

credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]

Health status of integration credentials.

One of the following:

"Initializing"

"Healthy"

"Unhealthy"

credentials_expiry: Optional[datetime]

The date and time when the integration credentials will expire.

formatdate-time

is_paused: Optional[bool]

Whether the given integration is paused by the user.

upgrade_dismissed: Optional[bool]

UI State as to whether a potential permissions upgrade has been dismissed.

latest_affliction_date: datetime

Timestamp of the latest affliction date of an active finding.

formatdate-time

severity_override: Optional[SeverityOverride]

Override information for finding severity.

created_by: str

User ID who created the override.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

CasbPostureFindingsInstances

List instances of a finding

zero_trust.casb.posture.findings.instances.list(strfinding_id, InstanceListParams**kwargs) -> SyncV4PagePaginationArray[InstanceListResponse]

GET/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances

Get a finding instance using an instance ID

zero_trust.casb.posture.findings.instances.get(strinstance_id, InstanceGetParams**kwargs) -> InstanceGetResponse

GET/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/{instance_id}

Create a finding instances export

zero_trust.casb.posture.findings.instances.export(strstorage_namespace_id, InstanceExportParams**kwargs) -> InstanceExportResponse

POST/accounts/{account_id}/data-security/posture/findings/{storage_namespace_id}/instances/export

Archive a finding

zero_trust.casb.posture.findings.instances.archive(strfinding_id, InstanceArchiveParams**kwargs) -> InstanceArchiveResponse

POST/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/archive

Remove the archive marking from a finding instance

zero_trust.casb.posture.findings.instances.unarchive(strfinding_id, InstanceUnarchiveParams**kwargs) -> InstanceUnarchiveResponse

POST/accounts/{account_id}/data-security/posture/findings/{finding_id}/instances/unarchive

ModelsExpand Collapse

class InstanceListResponse: …

A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

affliction_date: datetime

When this specific instance was identified.

formatdate-time

asset: Asset

Asset information including metadata and categorization.

category: AssetCategory

Category information for an asset.

service: Optional[str]

The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service.

type: str

The type of asset.

vendor: str

The vendor the asset is part of.

id: Optional[str]

Unique identifier for the asset category.

formatuuid

external_id: str

External identifier from the source system.

maxLength512

fields: List[AssetField]

The fields associated with the asset.

name: str

The name of the field.

value: str

The value of the field.

link: Optional[str]

Optional link associated with the field.

formaturi

name: str

Human-readable name of the asset.

id: Optional[str]

Unique identifier for the asset.

formatuuid

link: Optional[str]

Direct link to the asset.

formaturi

maxLength2048

dlp_contexts: List[DLPContext]

DLP context information if this is a content finding.

created: datetime

When the DLP context was created.

formatdate-time

entry_ids: List[str]

DLP Entry IDs.

profile_id: str

DLP Profile ID.

formatuuid

updated: datetime

When the DLP context was last updated.

formatdate-time

id: Optional[str]

Unique identifier for the DLP context.

formatuuid

deleted: Optional[datetime]

When the DLP context was deleted.

formatdate-time

match_context_max_extent: Optional[int]

DLP Right Boundary of match context.

maximum2147483647

minimum0

match_context_min_extent: Optional[int]

DLP Left Boundary of match context.

maximum2147483647

minimum0

match_context_payload: Optional[Dict[str, object]]

DLP Match context payload that matched the profile in question.

remediations: List[Remediation]

A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

id: str

Unique identifier for the remediation job.

formatuuid

created_at: datetime

When the remediation job was created.

formatdate-time

stale: bool

Whether this remediation job is stale (created before the finding instance’s affliction_date).

status: Literal["pending", "processing", "completed", 2 more]

Status of a remediation job.

One of the following:

"pending"

"processing"

"completed"

"failed"

"validating"

webhooks: List[Webhook]

The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction_date. If no webhook jobs have been created, this field will be an empty array.

latest_job: WebhookLatestJob

The most recent webhook job for this webhook configuration.

id: str

Unique identifier for the webhook job.

formatuuid

created_at: datetime

When the webhook job was created.

formatdate-time

stale: bool

Whether this webhook job is stale (created before the finding instance’s current affliction_date).

status: Literal["pending", "processing", "completed"]

Current status of the webhook job.

One of the following:

"pending"

"processing"

"completed"

webhook_id: str

Unique identifier for the webhook configuration.

formatuuid

webhook_label: str

Account-specified display label for the webhook configuration.

id: Optional[str]

Unique identifier for the finding instance.

formatuuid

is_archived: Optional[bool]

Whether this finding instance has been archived.

class InstanceGetResponse: …

A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

affliction_date: datetime

When this specific instance was identified.

formatdate-time

asset: Asset

Asset information including metadata and categorization.

category: AssetCategory

Category information for an asset.

service: Optional[str]

The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service.

type: str

The type of asset.

vendor: str

The vendor the asset is part of.

id: Optional[str]

Unique identifier for the asset category.

formatuuid

external_id: str

External identifier from the source system.

maxLength512

fields: List[AssetField]

The fields associated with the asset.

name: str

The name of the field.

value: str

The value of the field.

link: Optional[str]

Optional link associated with the field.

formaturi

name: str

Human-readable name of the asset.

id: Optional[str]

Unique identifier for the asset.

formatuuid

link: Optional[str]

Direct link to the asset.

formaturi

maxLength2048

dlp_contexts: List[DLPContext]

DLP context information if this is a content finding.

created: datetime

When the DLP context was created.

formatdate-time

entry_ids: List[str]

DLP Entry IDs.

profile_id: str

DLP Profile ID.

formatuuid

updated: datetime

When the DLP context was last updated.

formatdate-time

id: Optional[str]

Unique identifier for the DLP context.

formatuuid

deleted: Optional[datetime]

When the DLP context was deleted.

formatdate-time

match_context_max_extent: Optional[int]

DLP Right Boundary of match context.

maximum2147483647

minimum0

match_context_min_extent: Optional[int]

DLP Left Boundary of match context.

maximum2147483647

minimum0

match_context_payload: Optional[Dict[str, object]]

DLP Match context payload that matched the profile in question.

remediations: List[Remediation]

A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

id: str

Unique identifier for the remediation job.

formatuuid

created_at: datetime

When the remediation job was created.

formatdate-time

stale: bool

Whether this remediation job is stale (created before the finding instance’s affliction_date).

status: Literal["pending", "processing", "completed", 2 more]

Status of a remediation job.

One of the following:

"pending"

"processing"

"completed"

"failed"

"validating"

webhooks: List[Webhook]

The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction_date. If no webhook jobs have been created, this field will be an empty array.

latest_job: WebhookLatestJob

The most recent webhook job for this webhook configuration.

id: str

Unique identifier for the webhook job.

formatuuid

created_at: datetime

When the webhook job was created.

formatdate-time

stale: bool

Whether this webhook job is stale (created before the finding instance’s current affliction_date).

status: Literal["pending", "processing", "completed"]

Current status of the webhook job.

One of the following:

"pending"

"processing"

"completed"

webhook_id: str

Unique identifier for the webhook configuration.

formatuuid

webhook_label: str

Account-specified display label for the webhook configuration.

id: Optional[str]

Unique identifier for the finding instance.

formatuuid

is_archived: Optional[bool]

Whether this finding instance has been archived.

class InstanceExportResponse: …

Information about an export job.

id: str

Unique identifier for the export job.

formatuuid

status: Literal["Pending", "Success", "Failure", 2 more]

Status of an export job.

One of the following:

"Pending"

"Success"

"Failure"

"Rescheduled"

"In-Progress"

type: Literal["finding", "findingInstance", "content", "remediationJob"]

Type of export job.

One of the following:

"finding"

"findingInstance"

"content"

"remediationJob"

user_id: str

ID of the export-requesting user.

maxLength128

download_url: Optional[str]

The URL by which the successfully created export can be downloaded by the end users.

formaturi

maxLength1024

errors: Optional[str]

Contains information on errors which may have occurred during export creation.

file_name: Optional[str]

The base name of the file that is/was generated by the export job.

maxLength256

file_path: Optional[str]

The full path of the file that is stored within external storage (currently R2).

maxLength512

class InstanceArchiveResponse: …

A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

affliction_date: datetime

When this specific instance was identified.

formatdate-time

asset: Asset

Asset information including metadata and categorization.

category: AssetCategory

Category information for an asset.

service: Optional[str]

The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service.

type: str

The type of asset.

vendor: str

The vendor the asset is part of.

id: Optional[str]

Unique identifier for the asset category.

formatuuid

external_id: str

External identifier from the source system.

maxLength512

fields: List[AssetField]

The fields associated with the asset.

name: str

The name of the field.

value: str

The value of the field.

link: Optional[str]

Optional link associated with the field.

formaturi

name: str

Human-readable name of the asset.

id: Optional[str]

Unique identifier for the asset.

formatuuid

link: Optional[str]

Direct link to the asset.

formaturi

maxLength2048

dlp_contexts: List[DLPContext]

DLP context information if this is a content finding.

created: datetime

When the DLP context was created.

formatdate-time

entry_ids: List[str]

DLP Entry IDs.

profile_id: str

DLP Profile ID.

formatuuid

updated: datetime

When the DLP context was last updated.

formatdate-time

id: Optional[str]

Unique identifier for the DLP context.

formatuuid

deleted: Optional[datetime]

When the DLP context was deleted.

formatdate-time

match_context_max_extent: Optional[int]

DLP Right Boundary of match context.

maximum2147483647

minimum0

match_context_min_extent: Optional[int]

DLP Left Boundary of match context.

maximum2147483647

minimum0

match_context_payload: Optional[Dict[str, object]]

DLP Match context payload that matched the profile in question.

remediations: List[Remediation]

A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

id: str

Unique identifier for the remediation job.

formatuuid

created_at: datetime

When the remediation job was created.

formatdate-time

stale: bool

Whether this remediation job is stale (created before the finding instance’s affliction_date).

status: Literal["pending", "processing", "completed", 2 more]

Status of a remediation job.

One of the following:

"pending"

"processing"

"completed"

"failed"

"validating"

webhooks: List[Webhook]

The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction_date. If no webhook jobs have been created, this field will be an empty array.

latest_job: WebhookLatestJob

The most recent webhook job for this webhook configuration.

id: str

Unique identifier for the webhook job.

formatuuid

created_at: datetime

When the webhook job was created.

formatdate-time

stale: bool

Whether this webhook job is stale (created before the finding instance’s current affliction_date).

status: Literal["pending", "processing", "completed"]

Current status of the webhook job.

One of the following:

"pending"

"processing"

"completed"

webhook_id: str

Unique identifier for the webhook configuration.

formatuuid

webhook_label: str

Account-specified display label for the webhook configuration.

id: Optional[str]

Unique identifier for the finding instance.

formatuuid

is_archived: Optional[bool]

Whether this finding instance has been archived.

class InstanceUnarchiveResponse: …

A specific instance of a security finding. In the API interface, we refer to the ‘finding’ table in our DB as finding instances, optimized for the p99 use case.

affliction_date: datetime

When this specific instance was identified.

formatdate-time

asset: Asset

Asset information including metadata and categorization.

category: AssetCategory

Category information for an asset.

service: Optional[str]

The specific service within the vendor the asset is part of (often none). Example - AWS is the vendor, S3 is the service.

type: str

The type of asset.

vendor: str

The vendor the asset is part of.

id: Optional[str]

Unique identifier for the asset category.

formatuuid

external_id: str

External identifier from the source system.

maxLength512

fields: List[AssetField]

The fields associated with the asset.

name: str

The name of the field.

value: str

The value of the field.

link: Optional[str]

Optional link associated with the field.

formaturi

name: str

Human-readable name of the asset.

id: Optional[str]

Unique identifier for the asset.

formatuuid

link: Optional[str]

Direct link to the asset.

formaturi

maxLength2048

dlp_contexts: List[DLPContext]

DLP context information if this is a content finding.

created: datetime

When the DLP context was created.

formatdate-time

entry_ids: List[str]

DLP Entry IDs.

profile_id: str

DLP Profile ID.

formatuuid

updated: datetime

When the DLP context was last updated.

formatdate-time

id: Optional[str]

Unique identifier for the DLP context.

formatuuid

deleted: Optional[datetime]

When the DLP context was deleted.

formatdate-time

match_context_max_extent: Optional[int]

DLP Right Boundary of match context.

maximum2147483647

minimum0

match_context_min_extent: Optional[int]

DLP Left Boundary of match context.

maximum2147483647

minimum0

match_context_payload: Optional[Dict[str, object]]

DLP Match context payload that matched the profile in question.

remediations: List[Remediation]

A list of the 10 most recent remediation jobs for this finding instance, ordered by creation time (most recent first). The ‘stale’ field indicates whether the remediation job was created before the finding instance’s affliction_date (true) or after it (false). If there has never been a remediation job for this finding instance, this field will be an empty array.

id: str

Unique identifier for the remediation job.

formatuuid

created_at: datetime

When the remediation job was created.

formatdate-time

stale: bool

Whether this remediation job is stale (created before the finding instance’s affliction_date).

status: Literal["pending", "processing", "completed", 2 more]

Status of a remediation job.

One of the following:

"pending"

"processing"

"completed"

"failed"

"validating"

webhooks: List[Webhook]

The most recent webhook job invocation for each webhook configuration associated with this finding instance. Each entry represents the latest job (any status) per webhook config. The ‘stale’ field indicates whether the job was invoked before the finding instance’s current affliction_date. If no webhook jobs have been created, this field will be an empty array.

latest_job: WebhookLatestJob

The most recent webhook job for this webhook configuration.

id: str

Unique identifier for the webhook job.

formatuuid

created_at: datetime

When the webhook job was created.

formatdate-time

stale: bool

Whether this webhook job is stale (created before the finding instance’s current affliction_date).

status: Literal["pending", "processing", "completed"]

Current status of the webhook job.

One of the following:

"pending"

"processing"

"completed"

webhook_id: str

Unique identifier for the webhook configuration.

formatuuid

webhook_label: str

Account-specified display label for the webhook configuration.

id: Optional[str]

Unique identifier for the finding instance.

formatuuid

is_archived: Optional[bool]

Whether this finding instance has been archived.

CasbPostureExports

List all export jobs

zero_trust.casb.posture.exports.list(ExportListParams**kwargs) -> SyncV4PagePaginationArray[ExportListResponse]

GET/accounts/{account_id}/data-security/posture/exports

Get a single export job

zero_trust.casb.posture.exports.get(strid, ExportGetParams**kwargs) -> ExportGetResponse

GET/accounts/{account_id}/data-security/posture/exports/{id}

ModelsExpand Collapse

class ExportListResponse: …

Information about an export job.

id: str

Unique identifier for the export job.

formatuuid

status: Literal["Pending", "Success", "Failure", 2 more]

Status of an export job.

One of the following:

"Pending"

"Success"

"Failure"

"Rescheduled"

"In-Progress"

type: Literal["finding", "findingInstance", "content", "remediationJob"]

Type of export job.

One of the following:

"finding"

"findingInstance"

"content"

"remediationJob"

user_id: str

ID of the export-requesting user.

maxLength128

download_url: Optional[str]

The URL by which the successfully created export can be downloaded by the end users.

formaturi

maxLength1024

errors: Optional[str]

Contains information on errors which may have occurred during export creation.

file_name: Optional[str]

The base name of the file that is/was generated by the export job.

maxLength256

file_path: Optional[str]

The full path of the file that is stored within external storage (currently R2).

maxLength512

class ExportGetResponse: …

Information about an export job.

id: str

Unique identifier for the export job.

formatuuid

status: Literal["Pending", "Success", "Failure", 2 more]

Status of an export job.

One of the following:

"Pending"

"Success"

"Failure"

"Rescheduled"

"In-Progress"

type: Literal["finding", "findingInstance", "content", "remediationJob"]

Type of export job.

One of the following:

"finding"

"findingInstance"

"content"

"remediationJob"

user_id: str

ID of the export-requesting user.

maxLength128

download_url: Optional[str]

The URL by which the successfully created export can be downloaded by the end users.

formaturi

maxLength1024

errors: Optional[str]

Contains information on errors which may have occurred during export creation.

file_name: Optional[str]

The base name of the file that is/was generated by the export job.

maxLength256

file_path: Optional[str]

The full path of the file that is stored within external storage (currently R2).

maxLength512

CasbPostureFinding Types

List all finding types

zero_trust.casb.posture.finding_types.list(FindingTypeListParams**kwargs) -> SyncV4PagePaginationArray[FindingTypeListResponse]

GET/accounts/{account_id}/data-security/posture/finding_types

Get finding by ID

zero_trust.casb.posture.finding_types.get(strfinding_type_id, FindingTypeGetParams**kwargs) -> FindingTypeGetResponse

GET/accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}

ModelsExpand Collapse

class FindingTypeListResponse: …

Basic finding type information.

id: str

The unique identifier of the finding.

formatuuid

category: Category

Category information for a finding.

observation: Literal["Issue", "Insight", "Activity"]

The type of the observation.

One of the following:

"Issue"

"Insight"

"Activity"

product: Literal["SaaS", "Cloud"]

The product category.

One of the following:

"SaaS"

"Cloud"

type: Literal["Content", "Posture"]

The type of the finding category.

One of the following:

"Content"

"Posture"

name: str

The name of the finding.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

vendor: str

The SaaS/Cloud vendor of the platform with which the finding is associated.

class FindingTypeGetResponse: …

Basic finding type information.

id: str

The unique identifier of the finding.

formatuuid

category: Category

Category information for a finding.

observation: Literal["Issue", "Insight", "Activity"]

The type of the observation.

One of the following:

"Issue"

"Insight"

"Activity"

product: Literal["SaaS", "Cloud"]

The product category.

One of the following:

"SaaS"

"Cloud"

type: Literal["Content", "Posture"]

The type of the finding category.

One of the following:

"Content"

"Posture"

name: str

The name of the finding.

severity: Literal["Critical", "High", "Medium", "Low"]

The severity level of a finding.

One of the following:

"Critical"

"High"

"Medium"

"Low"

vendor: str

The SaaS/Cloud vendor of the platform with which the finding is associated.

CasbPostureFinding TypesRemediation Types

List remediation types for a finding type

zero_trust.casb.posture.finding_types.remediation_types.list(strfinding_type_id, RemediationTypeListParams**kwargs) -> SyncV4PagePaginationArray[RemediationTypeListResponse]

GET/accounts/{account_id}/data-security/posture/finding_types/{finding_type_id}/remediation_types

ModelsExpand Collapse

class RemediationTypeListResponse: …

Information about a remediation type.

id: str

The identifier for the remediation type.

formatuuid

description: str

A description of the action(s) taken by the remediation type.

display_name: str

The name of the remediation type as displayed in the cloudflare dashboard.

finding_type_id: str

The identifier of the finding_type which this remediation type should remediate.

formatuuid

remediation_type: str

The name of the remediation type.

CasbPostureContent

List DLP content findings

zero_trust.casb.posture.content.list(ContentListParams**kwargs) -> SyncV4PagePaginationArray[ContentListResponse]

GET/accounts/{account_id}/data-security/posture/content

Create a content export

zero_trust.casb.posture.content.export(ContentExportParams**kwargs) -> ContentExportResponse

POST/accounts/{account_id}/data-security/posture/content/export

ModelsExpand Collapse

class ContentListResponse: …

Content asset with DLP information.

asset_id: str

Unique identifier for the asset.

formatuuid

asset_name: str

Name of the asset.

dlp_contexts: List[DLPContext]

DLP context information for this asset.

created: datetime

When the DLP context was created.

formatdate-time

entry_ids: List[str]

DLP Entry IDs.

profile_id: str

DLP Profile ID.

formatuuid

updated: datetime

When the DLP context was last updated.

formatdate-time

id: Optional[str]

Unique identifier for the DLP context.

formatuuid

deleted: Optional[datetime]

When the DLP context was deleted.

formatdate-time

match_context_max_extent: Optional[int]

DLP Right Boundary of match context.

maximum2147483647

minimum0

match_context_min_extent: Optional[int]

DLP Left Boundary of match context.

maximum2147483647

minimum0

match_context_payload: Optional[Dict[str, object]]

DLP Match context payload that matched the profile in question.

dlp_profile_count: int

Number of DLP profiles that flagged this asset.

dlp_profile_ids: List[str]

IDs of DLP profiles that flagged this asset.

integration: Integration

Summary information about an integration.

created: datetime

When entity was created.

formatdate-time

last_hydrated: datetime

When were the integration credentials last updated.

formatdate-time

name: str

Name of the integration.

maxLength256

permissions: List[str]

The vendor-specific permissions associated with the integration.

policy: IntegrationPolicy

Policy configuration for an integration.

id: Optional[str]

Policy identifier.

formatuuid

client_id: Optional[str]

OAuth client ID for the policy.

compliance_level: Optional[str]

Compliance level for the policy.

dlp_enabled: Optional[bool]

Whether DLP is enabled for this policy.

link: Optional[str]

Link to policy documentation.

formaturi

name: Optional[str]

Policy name.

permissions: Optional[List[str]]

List of permissions included in the policy.

status: str

Current status of the integration.

updated: datetime

Last entity was updated.

formatdate-time

upgradable: bool

Whether the integrations permissions can be updated.

vendor: IntegrationVendor

Information about a vendor/service provider.

id: str

The id of the vendor.

description: Optional[str]

Detailed information about what kinds of issues are detected for this vendor.

display_name: str

The display name of the vendor.

logo: str

Logo URL for the vendor.

formaturi

name: str

The name of the vendor.

static_logo: str

Static logo URL for the vendor.

formaturi

zt_enrollments: List[str]

The vendor’s compatible Zero Trust products.

policies: Optional[List[Dict[str, object]]]

The policies related to the vendor.

zt_enrollments: List[IntegrationZtEnrollment]

Zero Trust products associated with this integration.

id: Optional[str]

The internal identifier of the Zero Trust Product.

description: Optional[str]

Brief description of the Zero Trust Product.

display_name: Optional[str]

The verbose name of the Zero Trust Product.

enabled: Optional[bool]

Flag to enable/disable access to the listed integration from the corresponding Cloudflare product.

id: Optional[str]

Integration ID.

formatuuid

credential_health_status: Optional[Literal["Initializing", "Healthy", "Unhealthy"]]

Health status of integration credentials.

One of the following:

"Initializing"

"Healthy"

"Unhealthy"

credentials_expiry: Optional[datetime]

The date and time when the integration credentials will expire.

formatdate-time

is_paused: Optional[bool]

Whether the given integration is paused by the user.

upgrade_dismissed: Optional[bool]

UI State as to whether a potential permissions upgrade has been dismissed.

latest_affliction_date: datetime

Most recent date this asset was flagged.

formatdate-time

class ContentExportResponse: …

Information about an export job.

id: str

Unique identifier for the export job.

formatuuid

status: Literal["Pending", "Success", "Failure", 2 more]

Status of an export job.

One of the following:

"Pending"

"Success"

"Failure"

"Rescheduled"

"In-Progress"

type: Literal["finding", "findingInstance", "content", "remediationJob"]

Type of export job.

One of the following:

"finding"

"findingInstance"

"content"

"remediationJob"

user_id: str

ID of the export-requesting user.

maxLength128

download_url: Optional[str]

The URL by which the successfully created export can be downloaded by the end users.

formaturi

maxLength1024

errors: Optional[str]

Contains information on errors which may have occurred during export creation.

file_name: Optional[str]

The base name of the file that is/was generated by the export job.

maxLength256

file_path: Optional[str]

The full path of the file that is stored within external storage (currently R2).

maxLength512

CasbPostureRemediations

CasbPostureRemediationsJobs

List remediation jobs

zero_trust.casb.posture.remediations.jobs.list(JobListParams**kwargs) -> SyncV4PagePaginationArray[JobListResponse]

GET/accounts/{account_id}/data-security/posture/remediations/jobs

Creates remediation jobs

zero_trust.casb.posture.remediations.jobs.create(JobCreateParams**kwargs) -> JobCreateResponse

POST/accounts/{account_id}/data-security/posture/remediations/jobs

Create a remediation jobs export

zero_trust.casb.posture.remediations.jobs.export(JobExportParams**kwargs) -> JobExportResponse

POST/accounts/{account_id}/data-security/posture/remediations/jobs/export

ModelsExpand Collapse

class JobListResponse: …

Information about a remediation job.

id: str

Unique identifier for the remediation job.

formatuuid

asset: Asset

Asset information for a remediation job.

id: str

Unique identifier for the asset.

formatuuid

category: AssetCategory

Category information for a remediation job asset.

service: str

Specific service within the vendor.

type: str

Asset type.

vendor: Literal["AWS", "Anthropic", "Bitbucket", 16 more]

Display names for vendor types.

One of the following:

"AWS"

"Anthropic"

"Bitbucket"

"Box"

"Confluence"

"Dropbox"

"GitHub"

"Google Cloud Platform"

"Google Workspace"

"Jira"

"Microsoft"

"Microsoft Internal"

"Okta"

"OpenAI"

"Slack"

"Salesforce"

"ServiceNow"

"Workday"

"Zoom"

external_id: str

External identifier from the source system.

fields: List[AssetField]

Additional fields associated with the asset.

name: str

Field name.

value: Union[str, float, bool]

Field value (can be string, number, or boolean).

One of the following:

str

float

bool

link: Optional[str]

Optional link associated with the field.

formaturi

name: str

Human-readable name of the asset.

link: Optional[str]

Direct link to the asset.

formaturi

created_at: datetime

When the remediation job was created.

formatdate-time

finding_id: str

Encoded finding ID.

finding_instance_id: str

ID of the finding instance being remediated.

formatuuid

finding_type_id: str

ID of the finding type.

formatuuid

finding_type_name: str

Name of the finding type.

integration_name: str

Name of the integration.

last_updated: datetime

When the remediation job was last updated.

formatdate-time

remediation_type: str

Type of remediation being performed.

status: Literal["pending", "processing", "completed", 2 more]

Status of a remediation job.

One of the following:

"pending"

"processing"

"completed"

"failed"

"validating"

triggered_by_user: str

Email of the user who triggered the remediation. For account-token actors this is the literal “Account API Token”; for policy actors this is empty.

triggered_by_actor: Optional[Literal["user", "account_token"]]

Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated.

One of the following:

"user"

"account_token"

triggered_by_id: Optional[str]

ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows.

class JobCreateResponse: …

created: List[Created]

Successfully created remediation jobs.

id: str

Unique identifier for the remediation job.

formatuuid

asset: CreatedAsset

Asset information for a remediation job.

id: str

Unique identifier for the asset.

formatuuid

category: CreatedAssetCategory

Category information for a remediation job asset.

service: str

Specific service within the vendor.

type: str

Asset type.

vendor: Literal["AWS", "Anthropic", "Bitbucket", 16 more]

Display names for vendor types.

One of the following:

"AWS"

"Anthropic"

"Bitbucket"

"Box"

"Confluence"

"Dropbox"

"GitHub"

"Google Cloud Platform"

"Google Workspace"

"Jira"

"Microsoft"

"Microsoft Internal"

"Okta"

"OpenAI"

"Slack"

"Salesforce"

"ServiceNow"

"Workday"

"Zoom"

external_id: str

External identifier from the source system.

fields: List[CreatedAssetField]

Additional fields associated with the asset.

name: str

Field name.

value: Union[str, float, bool]

Field value (can be string, number, or boolean).

One of the following:

str

float

bool

link: Optional[str]

Optional link associated with the field.

formaturi

name: str

Human-readable name of the asset.

link: Optional[str]

Direct link to the asset.

formaturi

created_at: datetime

When the remediation job was created.

formatdate-time

finding_id: str

Encoded finding ID.

finding_instance_id: str

ID of the finding instance being remediated.

formatuuid

finding_type_id: str

ID of the finding type.

formatuuid

finding_type_name: str

Name of the finding type.

integration_name: str

Name of the integration.

last_updated: datetime

When the remediation job was last updated.

formatdate-time

remediation_type: str

Type of remediation being performed.

status: Literal["pending", "processing", "completed", 2 more]

Status of a remediation job.

One of the following:

"pending"

"processing"

"completed"

"failed"

"validating"

triggered_by_user: str

Email of the user who triggered the remediation. For account-token actors this is the literal “Account API Token”; for policy actors this is empty.

triggered_by_actor: Optional[Literal["user", "account_token"]]

Type of actor that triggered the remediation job. Null on legacy rows created before this column was populated.

One of the following:

"user"

"account_token"

triggered_by_id: Optional[str]

ID of the actor that triggered the job. Meaning depends on triggered_by_actor. Null on legacy rows.

failed: List[Failed]

Failed remediation job creation attempts.

error: str

Error message describing the failure.

finding_instance_id: str

ID of the finding instance that failed to create a remediation job.

formatuuid

class JobExportResponse: …

Information about an export job.

id: str

Unique identifier for the export job.

formatuuid

status: Literal["Pending", "Success", "Failure", 2 more]

Status of an export job.

One of the following:

"Pending"

"Success"

"Failure"

"Rescheduled"

"In-Progress"

type: Literal["finding", "findingInstance", "content", "remediationJob"]

Type of export job.

One of the following:

"finding"

"findingInstance"

"content"

"remediationJob"

user_id: str

ID of the export-requesting user.

maxLength128

download_url: Optional[str]

The URL by which the successfully created export can be downloaded by the end users.

formaturi

maxLength1024

errors: Optional[str]

Contains information on errors which may have occurred during export creation.

file_name: Optional[str]

The base name of the file that is/was generated by the export job.

maxLength256

file_path: Optional[str]

The full path of the file that is stored within external storage (currently R2).

maxLength512

CasbPostureWebhooks

List webhook configurations

zero_trust.casb.posture.webhooks.list(WebhookListParams**kwargs) -> SyncSinglePage[WebhookListResponse]

GET/accounts/{account_id}/data-security/posture/webhooks

Create a new webhook configuration

zero_trust.casb.posture.webhooks.create(WebhookCreateParams**kwargs) -> WebhookCreateResponse

POST/accounts/{account_id}/data-security/posture/webhooks

Get webhook configuration by ID

zero_trust.casb.posture.webhooks.get(strwebhook_id, WebhookGetParams**kwargs) -> WebhookGetResponse

GET/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}

Update an existing webhook configuration

zero_trust.casb.posture.webhooks.update(strwebhook_id, WebhookUpdateParams**kwargs) -> WebhookUpdateResponse

PUT/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}

Delete a webhook configuration

zero_trust.casb.posture.webhooks.delete(strwebhook_id, WebhookDeleteParams**kwargs) -> WebhookDeleteResponse

DELETE/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}

Test a webhook configuration before creating it

zero_trust.casb.posture.webhooks.evaluate(WebhookEvaluateParams**kwargs) -> WebhookEvaluateResponse

POST/accounts/{account_id}/data-security/posture/webhooks/evaluate

Test an existing webhook configuration

zero_trust.casb.posture.webhooks.evaluate_existing(strwebhook_id, WebhookEvaluateExistingParams**kwargs) -> WebhookEvaluateExistingResponse

POST/accounts/{account_id}/data-security/posture/webhooks/{webhook_id}/evaluate

ModelsExpand Collapse

class WebhookListResponse: …

Webhook configuration for sending finding notifications.

id: str

Unique identifier for the specific webhook configuration.

formatuuid

authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]

Type of authentication used for the webhook.

One of the following:

"Basic Auth"

"None"

"Bearer Auth"

"Static Headers"

"HMAC-Signing"

created_at: datetime

Timestamp when the webhook configuration was created.

formatdate-time

destination_url: str

Target URL for the webhook configuration. Where resulting data will be sent.

formaturi

label: str

Account-specified display label for the webhook configuration.

status: Literal["enabled", "disabled"]

Current status of the webhook configuration. If disabled, data cannot be sent through this configuration.

One of the following:

"enabled"

"disabled"

updated_at: datetime

Timestamp when the webhook configuration was last updated.

formatdate-time

version: int

Version number of the configuration.

formatuint32

headers: Optional[List[Header]]

List of header keys configured for this webhook. Values are not included for security reasons.

key: Optional[str]

Header key name (lowercase).

value: Optional[str]

Header value. This field is never returned in API responses for security reasons.

class WebhookCreateResponse: …

Webhook configuration for sending finding notifications.

id: str

Unique identifier for the specific webhook configuration.

formatuuid

authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]

Type of authentication used for the webhook.

One of the following:

"Basic Auth"

"None"

"Bearer Auth"

"Static Headers"

"HMAC-Signing"

created_at: datetime

Timestamp when the webhook configuration was created.

formatdate-time

destination_url: str

Target URL for the webhook configuration. Where resulting data will be sent.

formaturi

label: str

Account-specified display label for the webhook configuration.

status: Literal["enabled", "disabled"]

Current status of the webhook configuration. If disabled, data cannot be sent through this configuration.

One of the following:

"enabled"

"disabled"

updated_at: datetime

Timestamp when the webhook configuration was last updated.

formatdate-time

version: int

Version number of the configuration.

formatuint32

headers: Optional[List[Header]]

List of header keys configured for this webhook. Values are not included for security reasons.

key: Optional[str]

Header key name (lowercase).

value: Optional[str]

Header value. This field is never returned in API responses for security reasons.

class WebhookGetResponse: …

Webhook configuration for sending finding notifications.

id: str

Unique identifier for the specific webhook configuration.

formatuuid

authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]

Type of authentication used for the webhook.

One of the following:

"Basic Auth"

"None"

"Bearer Auth"

"Static Headers"

"HMAC-Signing"

created_at: datetime

Timestamp when the webhook configuration was created.

formatdate-time

destination_url: str

Target URL for the webhook configuration. Where resulting data will be sent.

formaturi

label: str

Account-specified display label for the webhook configuration.

status: Literal["enabled", "disabled"]

Current status of the webhook configuration. If disabled, data cannot be sent through this configuration.

One of the following:

"enabled"

"disabled"

updated_at: datetime

Timestamp when the webhook configuration was last updated.

formatdate-time

version: int

Version number of the configuration.

formatuint32

headers: Optional[List[Header]]

List of header keys configured for this webhook. Values are not included for security reasons.

key: Optional[str]

Header key name (lowercase).

value: Optional[str]

Header value. This field is never returned in API responses for security reasons.

class WebhookUpdateResponse: …

Webhook configuration for sending finding notifications.

id: str

Unique identifier for the specific webhook configuration.

formatuuid

authentication_type: Literal["Basic Auth", "None", "Bearer Auth", 2 more]

Type of authentication used for the webhook.

One of the following:

"Basic Auth"

"None"

"Bearer Auth"

"Static Headers"

"HMAC-Signing"

created_at: datetime

Timestamp when the webhook configuration was created.

formatdate-time

destination_url: str

Target URL for the webhook configuration. Where resulting data will be sent.

formaturi

label: str

Account-specified display label for the webhook configuration.

status: Literal["enabled", "disabled"]

Current status of the webhook configuration. If disabled, data cannot be sent through this configuration.

One of the following:

"enabled"

"disabled"

updated_at: datetime

Timestamp when the webhook configuration was last updated.

formatdate-time

version: int

Version number of the configuration.

formatuint32

headers: Optional[List[Header]]

List of header keys configured for this webhook. Values are not included for security reasons.

key: Optional[str]

Header key name (lowercase).

value: Optional[str]

Header value. This field is never returned in API responses for security reasons.

class WebhookDeleteResponse: …

Common response structure for all API endpoints.

errors: List[Error]

code: int

Error or message code.

minimum1000

message: str

Human-readable message.

documentation_url: Optional[str]

Link to relevant documentation.

formaturi

source: Optional[ErrorSource]

pointer: Optional[str]

JSON pointer to the source of the error.

messages: List[Message]

code: int

Error or message code.

minimum1000

message: str

Human-readable message.

documentation_url: Optional[str]

Link to relevant documentation.

formaturi

source: Optional[MessageSource]

pointer: Optional[str]

JSON pointer to the source of the error.

success: bool

Whether the API call was successful.

class WebhookEvaluateResponse: …

Response body for webhook evaluation test results.

message: str

Human-readable message describing the test result.

status_code: int

HTTP status code returned by the webhook endpoint. 0 if connection failed.

success: bool

Whether the webhook test was successful (received 2xx response).

class WebhookEvaluateExistingResponse: …

Response body for webhook evaluation test results.

message: str

Human-readable message describing the test result.

status_code: int

HTTP status code returned by the webhook endpoint. 0 if connection failed.

success: bool

Whether the webhook test was successful (received 2xx response).

CasbPostureWebhooksJobs

Create webhook jobs

zero_trust.casb.posture.webhooks.jobs.create(JobCreateParams**kwargs) -> JobCreateResponse

POST/accounts/{account_id}/data-security/posture/webhooks/jobs

ModelsExpand Collapse

class JobCreateResponse: …

created: List[Created]

Successfully created webhook jobs.

id: str

Unique identifier for the webhook job.

formatuuid

asset_data: Dict[str, object]

Asset data associated with this webhook job.

created_at: datetime

When the webhook job was created.

formatdate-time

integration_id: str

ID of the integration.

formatuuid

last_updated_at: datetime

When the webhook job was last updated.

formatdate-time

parameters: CreatedParameters

Parameters for a webhook job.

finding_instance_id: str

ID of the finding instance.

formatuuid

status: Literal["pending", "processing", "completed", "failed"]

Status of a webhook job.

One of the following:

"pending"

"processing"

"completed"

"failed"

triggered_by_actor: Literal["user", "account_token"]

Type of actor that triggered the webhook job.

One of the following:

"user"

"account_token"

triggered_by_id: str

ID of the actor that triggered the job.

webhook_id: str

ID of the webhook configuration.

formatuuid

failure_details: Optional[Dict[str, object]]

Additional details about the failure.

failure_reason: Optional[Literal["Permission Denied", "Integration Unavailable", "Service Temporarily Unavailable", "System Error"]]

Reason for webhook job failure.

One of the following:

"Permission Denied"

"Integration Unavailable"

"Service Temporarily Unavailable"

"System Error"

failed: List[Failed]

Failed webhook job creation attempts.

error: str

Error message describing the failure.

finding_instance_id: str

ID of the finding instance that failed to create a webhook job.

formatuuid

webhook_id: str

ID of the webhook configuration.

formatuuid